1# drmserver - DRM service 2type drmserver, domain; 3type drmserver_exec, exec_type, file_type; 4 5init_daemon_domain(drmserver) 6typeattribute drmserver mlstrustedsubject; 7 8net_domain(drmserver) 9 10# Perform Binder IPC to system server. 11binder_use(drmserver) 12binder_call(drmserver, system_server) 13binder_call(drmserver, appdomain) 14binder_service(drmserver) 15 16# Perform Binder IPC to mediaserver 17binder_call(drmserver, mediaserver) 18 19allow drmserver sdcard_type:dir search; 20allow drmserver drm_data_file:dir create_dir_perms; 21allow drmserver drm_data_file:file create_file_perms; 22allow drmserver tee_device:chr_file rw_file_perms; 23allow drmserver app_data_file:file { read write getattr }; 24allow drmserver sdcard_type:file { read write getattr }; 25r_dir_file(drmserver, efs_file) 26 27type drmserver_socket, file_type; 28 29# /data/app/tlcd_sock socket file. 30# Clearly, /data/app is the most logical place to create a socket. Not. 31allow drmserver apk_data_file:dir rw_dir_perms; 32type_transition drmserver apk_data_file:sock_file drmserver_socket; 33allow drmserver drmserver_socket:sock_file create_file_perms; 34allow drmserver tee:unix_stream_socket connectto; 35# Delete old socket file if present. 36allow drmserver apk_data_file:sock_file unlink; 37 38# After taking a video, drmserver looks at the video file. 39r_dir_file(drmserver, media_rw_data_file) 40 41# Read resources from open apk files passed over Binder. 42allow drmserver apk_data_file:file { read getattr }; 43allow drmserver asec_apk_file:file { read getattr }; 44 45# Read /data/data/com.android.providers.telephony files passed over Binder. 46allow drmserver radio_data_file:file { read getattr }; 47 48# /oem access 49allow drmserver oemfs:dir search; 50allow drmserver oemfs:file r_file_perms; 51 52allow drmserver drmserver_service:service_manager { add find }; 53allow drmserver permission_service:service_manager find; 54 55selinux_check_access(drmserver) 56